VoIP.infoThe independent guide to business communications.
VoIP.info Troubleshooting

Asterisk AMI PJSIP auth list is missing, wrong or exposes secrets

Trace an auth inventory disagreement through list completion, node identity, loaded relationships, versioned digest support, credential handling and the actual SIP exchange.

Reviewed 2026-10-19Current branch-23 PJSIPShowAuths, AuthList, AuthListComplete, AuthDetail, PJSIPShowEndpoint, EndpointDetail and res_pjsip references plus PJSIP authentication, troubleshooting and AMI guidance were reviewed October 19, 2026. Installed branch, linked pjproject and OpenSSL capabilities, loaded modules, manager action inventory, permissions and transport, configuration owner, auth population, endpoint and registration relationships, credential values, challenge exchange and call behavior remain deployment specific. No PBX, module, manager account, session, auth object, password, digest, OAuth secret, endpoint, registration, SIP challenge, packet, media stream or live call was inspected or testedAdvancedDocumentation based · not lab tested

Freeze the disputed observation without copying secrets

Record timestamp and timezone, node and branch, manager identity, action and ActionID, response, AuthListComplete, expected object name, configuration owner, intended endpoint or registration, auth role, username, realm and algorithm labels. Record only whether protected credential fields were present; do not retain their values.

Classify the symptom: action missing; list incomplete; auth absent; unexpected duplicate or stale object; wrong association; wrong realm or algorithm; authentication failure despite a loaded row; or secret-bearing fields reaching logs or an unauthorized client.

Prove action availability, authority and completion

Verify the installed branch and loaded module expose PJSIPShowAuths. Confirm the manager account can execute the action and receive command-class list events. Require AuthListComplete and reconcile its ListItems after documented parsing and redaction.

Do not interpret permission denial, disconnect, timeout, cancellation, parser loss or querying another node as a completed empty list. Do not broaden a production manager account merely to make one inventory call work.

Resolve the loaded object and consumer relationship

Match ObjectName byte-for-byte in the completed inventory. Then inspect the exact endpoint through its bounded detail transaction and compare Auth and OutboundAuth references with every associated AuthDetail row. Inspect the exact outbound-registration object separately when it owns the challenge response.

If saved and loaded state differ, follow the supported configuration owner, generation and reload path. On FreePBX, repair the owning GUI or supported custom setting rather than editing generated files.

Check role, realm and algorithm capability

Determine whether Asterisk is the UAS issuing a challenge or the UAC answering one. For incoming authentication, the realm is advertised in WWW-Authenticate; for outgoing authentication it must match the received realm or use the documented empty or wildcard behavior. Do not reuse one object across roles merely because the username matches.

Compare loaded auth_type, realm, password or digest presence and supported UAC/UAS algorithms with the running branch, pjproject and OpenSSL build. A configuration value is not runtime support, and a digest made for one username, realm and algorithm cannot repair another.

Trace one challenge exchange and the identification path

Preserve the original request, 401 or 407 challenge, each advertised algorithm, retried request, Authorization or Proxy-Authorization header metadata and final response. Redact response values and credentials before storage. A normal first challenge is not the same as a final authentication failure.

Keep endpoint identification separate. If auth_username participates, the matching header appears only after a challenge, which changes security-event timing. IP, From username, Request-URI and auth username are different matching inputs.

Correct the first divergence and contain any disclosure

Correct only the proven boundary: action availability, AMI authority, parser, node, configuration ownership, missing association, role, realm, algorithm support or credential material. Repeat a redacted completed inventory, exact consumer detail and one authorized exchange, then verify the intended registration or call separately.

If a password, digest, OAuth secret or refresh token reached an unauthorized log, ticket or client, restrict access, preserve minimal incident evidence and rotate or revoke the affected credential through its authoritative owner. No PBX, module, manager account, session, auth object, password, digest, OAuth secret, endpoint, registration, SIP challenge, packet, media stream or live call was inspected or tested.

Sources & applicability

Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.

Examples require adaptation to your topology. No live PBX or hardware testing is claimed.

Continue your research

Guide · Current branch-23 PJSIPShowAuths, AuthList, AuthListComplete, AuthDetail, PJSIPShowEndpoint, EndpointDetail and res_pjsip references plus PJSIP authentication, troubleshooting and AMI guidance were reviewed October 19, 2026. Installed branch, linked pjproject and OpenSSL capabilities, loaded modules, manager action inventory, permissions and transport, configuration owner, auth population, endpoint and registration relationships, credential values, challenge exchange and call behavior remain deployment specific. No PBX, module, manager account, session, auth object, password, digest, OAuth secret, endpoint, registration, SIP challenge, packet, media stream or live call was inspected or tested

Asterisk AMI PJSIP auth lists and credential evidence

Separate the complete loaded-auth inventory from endpoint-associated detail, authentication roles, algorithm capability and protected credential material.

Read guide →
Troubleshooting · Asterisk 22 PJSIP authentication, res_pjsip and troubleshooting documentation plus RFC 8760 and RFC 7616 reviewed October 6, 2026; no PBX, build, auth object, endpoint, registration, provider, credential, packet exchange, rate limit, account state, protected transport or call was inspected or tested

Asterisk PJSIP repeated 401 or 407 authentication diagnosis

Decide whether a challenge is normal, then trace realm, algorithm, credential selection and the authorized retry before rotating secrets.

Read guide →
Guide · Asterisk 22 PJSIP authentication and res_pjsip documentation, RFC 8760 and RFC 7616 reviewed October 6, 2026; no Asterisk build, PJProject or OpenSSL library, auth object, endpoint, registration, provider, credential, challenge, protected transport, call or interoperability combination was inspected or tested

Asterisk PJSIP digest authentication: roles, realms and algorithms

Separate inbound and outbound auth objects, bind realms to credentials, and verify the algorithm actually used on an Asterisk 22 SIP exchange.

Read guide →
Guide · Asterisk branch-23-generated and branch-22-generated ListCommands references plus official AMI syntax, v2 specification, manager-command, change/versioning, permission, module-loader and network-security documentation reviewed October 16, 2026; installed branch and maintenance release, build, package and module set, manager user, read and write authorizations, session mask, action registration, request framing, parameters, target objects, response, related events and service outcome remain deployment specific; no PBX, module, package, manager user, manager session, request, response, event, configuration file, channel, packet, media stream or live call was inspected or tested

Asterisk AMI command inventory and permission evidence

Use ListCommands and the administrator CLI to distinguish the actions visible to one manager user from the actions registered by the running Asterisk instance.

Read guide →
Guide

PBX credentials and extension secrets

Keep administrator, handset, trunk and backup identities separate and retire them deliberately.

Read guide →
Guide · Current Asterisk CLI, logging, PJSIP troubleshooting and call-identifier documentation reviewed September 30, 2026; CLI commands are not shell commands; no PBX, trace, call or media tested

Asterisk CLI and PJSIP logging for one failed call

Bind one failed call to the loaded PJSIP objects, dialplan decision and short signaling trace, then prove diagnostic cleanup.

Read guide →